Nearly half of March ransomware attacks in tied to just 3 groups

Analysis by Check Point researchers showed that out of the 672 ransomware attacks reported in March 2026, Qilin alone accounted for 20%, followed by Akira, which was responsible for 12% of the attacks, and Dragonforce RaaS, which was responsible for 8% of the incidents, reports Infosecurity News.

"Attackers continue refining precision, timing, and targeting, exploiting seasonal cycles, emerging technologies, and operational blind spots," said Check Point research. Qilin, which has been active since 2022, was previously linked to an attack affecting Asahi, an international brewing company. Meanwhile, Akira continues to target organizations operating in the industrial manufacturing and business services sectors, focusing on ESXi, Windows, and Linux systems.

Researchers observed a rise in activities of the Dragonforce gang, linked to the increase in social engineering campaigns and the absorption of RansomHub affiliates. Findings also showed ransomware continues to pose a persistent cybersecurity threat globally. 52% of the reported affected entities are organizations based in the U.S.